OAuth2JWT Authentication Policy Configuration Values

The steps below show a sample example of how to configure an endpoint that meets the requirements for simultaneously supporting legacy Cloud API Management OAuth2 access tokens and JWT on the same endpoint.

Prerequisite: Key & Method Detection Settings

Before configuring OAuth2JWT Authentication Policy on the Call Transformation page, ensure you have set the following values on the Cloud API Management Endpoint Key & Method Detection page:

Request Authentication Type: Select Custom.
Developer's API Key Location: Select Custom.
Key Field Identifier: Enter the <fieldname to identify in payload claim>. This must not be a registered claim.
Custom Request Authentication Adapter: Enter com.mashery.proxy.customer.generic.oauth2-jwt-authenticator.

Configuration Values

The following configuration values can be defined while configuring the OAuth2JWT Authentication Policy on the Call Transformation page:

Field name	Type	Field Value	Required/Optional	Description
Processing Adapter	String	`com.mashery.proxy.customer.generic.oauth2-jwt-authenticator`	Required	Adapter used to authenticate API requests using a Cloud API Management OAuth2 access token together with a third-party JWT at the same service endpoint.
Perform Pre-processing	Boolean	Enabled	Required	When enabled, the policy validates the OAuth2 access token and JWT, and enriches the request, before it is forwarded to the backend.
Data to make available for pre-processing (PreInput Value)	Map	—	Required	Specifies the input data made available for pre-processing.
	String	`jwks_uri: <path location>`	Required	Request path for JWKS (JSON web key set) location.
	Integer	`jwks_cache_expiry: <minutes>`	Required	Value is in minutes.
	Integer	`token_expiry_override: <minutes>`	Optional	Value is in minutes. Override JWT expiry with configured time that should be less than original JWT ttl.
	String	`iss: <string>`	Optional	String values.
	String	`aud: <string>`	Optional	String values.
	Map	`nonstandard_claims: {"<HEADER1_NAME>":"<CLAIM1_NAME>","<HEADER2_NAME>":"<CLAIM2_NAME>",..}`	Optional	Key:value pair.
	Map	`inject_headers: {"<HEADER1_NAME>":"<CLAIM1_NAME>","<HEADER2_NAME>":"<CLAIM2_NAME>",..}`	Optional	Key:value pair.
	Boolean	`block_authorization_header:<true/false>`	Optional	Default value: `true`. Note: This setting is only applicable for a JWT token that needs to be forwarded to or blocked from the origin server.
	String	`http_proxy_server : <string>`	Optional	Proxy server to retrieve JWKS.
	Integer	`http_proxy_port : <integer>`	Optional	Proxy server port to retrieve JWKS.
	String	`shared_token_spkey:<string>`	Optional	SPKey of another API service, where the OAuth2 token is generated. Note: Provide this PreInput Value parameter only when OAuth2 tokens generated from another API service need to be validated at this endpoint.

Examples

The following are example values for the Data to make available for pre-processing field.

jwks_uri: http://content.mock.acme.com/stest/test/AJ792_MAIF_CLIENTPUBKEY.json
jwks_cache_expiry: 5
token_expiry_override: 5
iss: https://issuer1.com/ , https://issuer2.com/
aud: Google, Facebook, Yahoo

nonstandard_claims: {"Groups":"Group1, Group2", "Whitelisted":" abc.com , xyz.com "}

inject_headers: {"Audience":"aud","Issuer":"iss","X-Mashery-App-Id":"$.pib.master_app_id"}

block_authorization_header : false
http_proxy_server : squid.example.com
http_proxy_port : 3128
shared_token_spkey:942yzkggypg5dq6c4ucfv3ed

Configuration Steps

You can configure this policy using either of the following UIs: